You are correct. Maintainer scripts are not supposed to make any changes to the apt or dpkg states, other than the changes that will be made when installing the package anyway.

Installing a file into /etc/apt/sources.list.d, though, is fine. Most packages that fill a role like "install this package to add the APT repository X to your system" simply do that (as opposed to calling add-apt-repository). It's also common to drop the GPG public key used to sign the repo into /etc/apt/trusted.gpg.d.

If you want to make it simple for the user to perform the additional installation steps for your software, you might just want to ship a script which does the job, and tell the user to run the script manually.

But if you really, really want to call apt-get update or apt-get install, etc automatically, and you don't mind that your package will be wholly unacceptable in Debian or Ubuntu proper, and your users are ok with the package acting that way, then you could perhaps put something in /etc/cron.d which checks for any existing apt or dpkg locks, and if none are held, performs your additional installation steps and arranges for those steps not to be performed again. I don't recommend that approach.